Horizon exposes internal IP addresses via keystone/svc-catalog API
Bug #1798832 reported by
Oleksiy Petrenko
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Dashboard (Horizon) |
Fix Released
|
Undecided
|
Oleksiy Petrenko | ||
Bug Description
Example url: https://<horizon>
Different application responses contain resource links which disclose internal IP addresses. Threat actors could learn valuable information and plan further attacks on disclosed systems. Horizon should avoid including internal IP addresses in application responses
| Changed in horizon: | |
| assignee: | nobody → Oleksiy Petrenko (enacero) |
| status: | New → In Progress |
Revision history for this message
| OpenStack Infra (hudson-openstack) wrote Fix merged to horizon (master) | #1 |
| Changed in horizon: | |
| status: | In Progress → Fix Released |
Revision history for this message
| OpenStack Infra (hudson-openstack) wrote Fix included in openstack/horizon 15.0.0.0b1 | #2 |
To post a comment you must log in.
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: master
commit 31718cd1afe9bf1
Author: Alex Petrenko <email address hidden>
Date: Fri Oct 19 12:10:38 2018 +0300
Refactor app response for api request '/api/keystone/
Add filtration for service catalog. Now all endpoints that are not
public will not be seen.
Change-Id: I6db214f849d13c
Closes-Bug: #1798832